Skip to content

Commit 7fb0f7c

Browse files
rdimitrovclaude
rdimitrov
and
claude
authored
chore: consolidate dependency updates and switch to Renovate (#154)
* chore: consolidate dependency updates and switch to Renovate Consolidate all pending Dependabot PRs into a single update and migrate from Dependabot to Renovate for dependency management. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update Dockerfile Go version, fix lint and security vulnerabilities - Update Dockerfile from Go 1.23.7 to 1.25.0 (required by go.mod) - Fix gosec G706 log injection warning by using %q formatting - Update go-git/v5 to v5.16.5 (fixes GHSA-37cx-329c-33x3) - Update moby/buildkit to v0.28.1 (fixes GHSA-4c29-8rgm-jvjj, GHSA-4vrq-3vrq-g6gg) - Update docker/cli to v29.2.1 (fixes GHSA-p436-gjf2-799p) - Update cloudflare/circl to v1.6.3 (fixes GHSA-q9hv-hpm4-hj6x) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use Go 1.25.5 in Dockerfile and remove tainted log input - Dockerfile now uses golang:1.25.5-alpine to match go.mod requirement - Remove tainted user input from log message to satisfy gosec G706 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 7dcfb47 commit 7fb0f7c

10 files changed

Lines changed: 106 additions & 114 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎.github/workflows/publish.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ jobs:
2424

2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828

2929
- name: Set up Go
30-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
30+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
3131
with:
3232
go-version-file: 'go.mod'
3333

@@ -45,7 +45,7 @@ jobs:
4545
echo "Using tag: $TAG"
4646
4747
- name: Log in to the Container registry
48-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
48+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
4949
with:
5050
registry: ${{ env.REGISTRY }}
5151
username: ${{ github.actor }}
@@ -55,7 +55,7 @@ jobs:
5555
uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
5656

5757
- name: Install Cosign
58-
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
58+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
5959

6060
- name: Build and Push Image to GHCR
6161
run: |

‎.github/workflows/security-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
name: Grype
1010
steps:
1111
- name: Checkout
12-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
12+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1313
- name: Security Scan
1414
id: grype-scan
1515
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2

‎.github/workflows/test.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: Checkout
12-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
12+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1313
- uses: ./ # Uses an action in the root directory
1414
env:
1515
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121
steps:
2222
- name: Checkout
23-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2424
- uses: ./ # Uses an action in the root directory
2525
env:
2626
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -35,7 +35,7 @@ jobs:
3535
runs-on: ubuntu-latest
3636
steps:
3737
- name: Checkout
38-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3939
- uses: ./ # Uses an action in the root directory
4040
env:
4141
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
5050
runs-on: ubuntu-latest
5151
steps:
5252
- name: Checkout
53-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
53+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5454
- uses: ./ # Uses an action in the root directory
5555
env:
5656
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -65,7 +65,7 @@ jobs:
6565
runs-on: ubuntu-latest
6666
steps:
6767
- name: Checkout
68-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6969
- uses: ./ # Uses an action in the root directory
7070
env:
7171
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -80,7 +80,7 @@ jobs:
8080
runs-on: ubuntu-latest
8181
steps:
8282
- name: Checkout
83-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
83+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8484
- uses: ./ # Uses an action in the root directory
8585
env:
8686
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -95,7 +95,7 @@ jobs:
9595
runs-on: ubuntu-latest
9696
steps:
9797
- name: Checkout
98-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
98+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9999
- uses: ./ # Uses an action in the root directory
100100
env:
101101
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -106,7 +106,7 @@ jobs:
106106
runs-on: ubuntu-latest
107107
steps:
108108
- name: Checkout
109-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
109+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
110110
- uses: ./ # Uses an action in the root directory
111111
env:
112112
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/testbuild.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Check out code into the Go module directory
13-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1414
- name: Set up Go
15-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v3
15+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
1616
with:
1717
go-version-file: 'go.mod'
1818
- name: Get dependencies
@@ -23,24 +23,24 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Check out code into the Go module directory
26-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727
- name: Set up Go
28-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v3
28+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
2929
with:
3030
go-version-file: 'go.mod'
3131
- name: golangci-lint
32-
uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
32+
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
3333
docker_build:
3434
name: Build Docker Image
3535
runs-on: ubuntu-latest
3636
needs: test # No point building images if tests don't pass
3737
steps:
3838
- name: Check out code
39-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4040
- name: Set up Docker Buildx
41-
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
41+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
4242
- name: Build Docker image
43-
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
43+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
4444
with:
4545
context: .
4646
push: false

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM index.docker.io/library/golang:1.23.7-alpine@sha256:e438c135c348bd7677fde18d1576c2f57f265d5dfa1a6b26fca975d4aa40b3bb
1+
FROM index.docker.io/library/golang:1.25.5-alpine@sha256:ac09a5f469f307e5da71e766b0bd59c9c49ea460a528cc3e6686513d64a6f1fb
22

33
COPY . /home/src
44
WORKDIR /home/src

‎go.mod‎

Lines changed: 23 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,57 @@
11
module github.com/stacklok/frizbee-action
22

3-
go 1.23.2
4-
5-
toolchain go1.24.2
3+
go 1.25.5
64

75
require (
86
github.com/deckarep/golang-set/v2 v2.8.0
9-
github.com/go-git/go-billy/v5 v5.6.2
10-
github.com/go-git/go-git/v5 v5.16.0
7+
github.com/go-git/go-billy/v5 v5.7.0
8+
github.com/go-git/go-git/v5 v5.16.5
119
github.com/google/go-github/v60 v60.0.0
12-
github.com/stacklok/frizbee v0.1.7
10+
github.com/stacklok/frizbee v0.1.8
1311
)
1412

1513
require (
1614
dario.cat/mergo v1.0.0 // indirect
1715
github.com/Microsoft/go-winio v0.6.2 // indirect
18-
github.com/ProtonMail/go-crypto v1.1.6 // indirect
19-
github.com/cloudflare/circl v1.6.1 // indirect
20-
github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
16+
github.com/ProtonMail/go-crypto v1.3.0 // indirect
17+
github.com/cloudflare/circl v1.6.3 // indirect
18+
github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
2119
github.com/containerd/typeurl/v2 v2.2.3 // indirect
22-
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
23-
github.com/docker/cli v27.5.1+incompatible // indirect
20+
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
21+
github.com/docker/cli v29.2.1+incompatible // indirect
2422
github.com/docker/distribution v2.8.3+incompatible // indirect
25-
github.com/docker/docker-credential-helpers v0.8.2 // indirect
23+
github.com/docker/docker-credential-helpers v0.9.5 // indirect
2624
github.com/emirpasic/gods v1.18.1 // indirect
2725
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
2826
github.com/gogo/protobuf v1.3.2 // indirect
2927
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
30-
github.com/google/go-containerregistry v0.20.3 // indirect
28+
github.com/google/go-containerregistry v0.20.7 // indirect
3129
github.com/google/go-github/v66 v66.0.0 // indirect
3230
github.com/google/go-querystring v1.1.0 // indirect
3331
github.com/inconshreveable/mousetrap v1.1.0 // indirect
3432
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
3533
github.com/kevinburke/ssh_config v1.2.0 // indirect
36-
github.com/klauspost/compress v1.17.11 // indirect
34+
github.com/klauspost/compress v1.18.4 // indirect
3735
github.com/mitchellh/go-homedir v1.1.0 // indirect
38-
github.com/moby/buildkit v0.20.2 // indirect
36+
github.com/moby/buildkit v0.28.1 // indirect
3937
github.com/opencontainers/go-digest v1.0.0 // indirect
40-
github.com/opencontainers/image-spec v1.1.0 // indirect
38+
github.com/opencontainers/image-spec v1.1.1 // indirect
4139
github.com/pjbgf/sha1cd v0.3.2 // indirect
4240
github.com/pkg/errors v0.9.1 // indirect
4341
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
4442
github.com/puzpuzpuz/xsync v1.5.2 // indirect
4543
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
46-
github.com/sirupsen/logrus v1.9.3 // indirect
44+
github.com/sirupsen/logrus v1.9.4 // indirect
4745
github.com/skeema/knownhosts v1.3.1 // indirect
48-
github.com/spf13/cobra v1.9.1 // indirect
49-
github.com/spf13/pflag v1.0.6 // indirect
50-
github.com/vbatts/tar-split v0.11.6 // indirect
46+
github.com/spf13/cobra v1.10.2 // indirect
47+
github.com/spf13/pflag v1.0.10 // indirect
48+
github.com/vbatts/tar-split v0.12.2 // indirect
5149
github.com/xanzy/ssh-agent v0.3.3 // indirect
52-
golang.org/x/crypto v0.37.0 // indirect
53-
golang.org/x/net v0.39.0 // indirect
54-
golang.org/x/sync v0.12.0 // indirect
55-
golang.org/x/sys v0.32.0 // indirect
56-
google.golang.org/protobuf v1.36.3 // indirect
50+
golang.org/x/crypto v0.48.0 // indirect
51+
golang.org/x/net v0.51.0 // indirect
52+
golang.org/x/sync v0.19.0 // indirect
53+
golang.org/x/sys v0.41.0 // indirect
54+
google.golang.org/protobuf v1.36.11 // indirect
5755
gopkg.in/warnings.v0 v0.1.2 // indirect
5856
gopkg.in/yaml.v3 v3.0.1 // indirect
5957
)

0 commit comments

Comments
 (0)